Privacy Policy

1. Who We Are

EchoPitch is a product of Cavefish, a company registered in England and Wales. Cavefish is the data controller responsible for your personal data.

ICO Registration: ZB915633
Contact: hello@echopitch.io

2. Data We Collect

We collect the following types of data:

Account Information: Email address, name, and password (hashed)
Practice Recordings: The audio of your practice answers, and the video only if you switch on video saving
Transcripts and Reports: The transcript of each answer and the feedback and scores we generate from it
Facial Expression Measurements: Numerical measurements (not images) calculated in your browser during a session
Pitch Scorer Clips: Clips you upload to the free Pitch Scorer
Usage Data: How you interact with EchoPitch, session timestamps, and feature usage
Device Information: Browser type, operating system, and IP address

3. How We Process Your Data

How a practice session is processed: the audio of your answer is sent to OpenAI to be transcribed, and the transcript is sent to Anthropic to generate your feedback. Your camera video is not sent to any AI service; facial expression measurements are calculated in your browser and only the resulting numbers reach our servers.

Video saving is off by default. If you switch it on, the video is stored in private storage and can only be opened through short-lived private links, by you and, if your account belongs to an organisation, its coaches and administrators. You can delete a saved video at any time from its report. Clips uploaded to the free Pitch Scorer are sent to OpenAI for transcription and stored in private storage.

We process your data for the following purposes:

To provide AI-powered feedback on your presentations
To track your progress and improvement over time
To improve the quality of our service
To communicate with you about your account and our services
To comply with legal obligations

4. AI Model Training

We do not use your recordings, transcripts or reports to train AI models.

Our AI providers, OpenAI and Anthropic, process this data through their business APIs to provide the service to you.

5. Legal Basis for Processing

Under GDPR, we process your data based on:

Contract: To provide the service you signed up for
Legitimate Interest: To improve our service and prevent fraud
Consent: For optional features like marketing communications
Legal Obligation: To comply with applicable laws

6. Data Retention

We retain your data only as long as necessary:

Account data: Until you delete your account
Saved practice videos: Until you delete the video or your account
Pitch Scorer clips: Until you ask us to delete them
Feedback and scores: Until you delete your account
Usage analytics: 24 months, then anonymised

7. Your Rights

Under GDPR, you have the right to:

Access: Request a copy of your personal data
Rectification: Correct inaccurate data
Erasure: Delete your account and all associated data
Portability: Receive your data in a machine-readable format
Objection: Object to certain processing activities
Restriction: Limit how we process your data

To exercise these rights, contact us at hello@echopitch.io.

8. Deleting Your EchoPitch Account

You can delete your EchoPitch account and its data at any time, on the website or in the Android or iPhone app.

Signed in:go to Settings > Privacy > Delete account and confirm. The account is deleted straight away.
Can't sign in: email hello@echopitch.iowith the subject “Delete my EchoPitch account”, from the address you signed up with if you can. We confirm the request by replying to the account's email address, delete the account within 30 days, and email you when it is done.

What we delete:your account and profile, every practice session, transcript, score and report, saved practice videos, and Pitch Scorer clips linked to your email. Any subscription bought on the website is cancelled so you are not charged again. A subscription bought in the iPhone app is billed by Apple: cancel it in Settings > Apple ID > Subscriptions, because deleting your account does not stop Apple's billing.

What we keep: records of payments and invoices, which UK tax law requires us to keep for six years. Our payment processor, Stripe, holds these; we do not keep card details. Analytics that are already anonymised cannot be linked back to you and are not affected.

9. Data Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security audits.

Third-Party Sub-Processors: We use the following service providers to deliver EchoPitch:

Vercel Inc. (USA) — Hosting and infrastructure
Supabase Inc. (data stored in the EU, Ireland) — Database, authentication and private file storage
OpenAI, L.L.C. (USA) — Speech-to-text transcription of practice audio and Pitch Scorer clips
Anthropic, PBC (USA) — Generating feedback from transcripts
Resend Inc. (USA) — Sending account and receipt emails
Google LLC (USA) — Analytics (Google Analytics 4) with consent-based tracking
Formspree Inc. (USA) — Contact form processing
Stripe Inc. (USA) — Payment processing
Meta Platforms Ireland Ltd — Advertising measurement (Meta Pixel and Conversions API), only if you accept advertising cookies

10. International Transfers

Your data may be processed by AI providers and infrastructure services located outside the UK/EEA, specifically OpenAI (transcription), Anthropic (feedback), Vercel (hosting), Resend (email) and Stripe (payments) in the United States.

Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK ICO, or adequacy decisions. All sub-processors are contractually bound to protect your data to standards equivalent to UK GDPR.

11. Cookies

We use essential cookies to operate our service and analytics cookies to understand usage. If you click "OK" on our cookie banner, we also use advertising cookies from Meta (the Meta Pixel) to measure whether our Facebook and Instagram ads lead to sign-ups and purchases; when you buy, we then send Meta a hashed copy of your email address and your browser identifiers so the purchase can be matched to the ad. If you click "Opt out", no advertising cookies are set and nothing is sent to Meta. You can manage cookie preferences in your browser settings.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the service. Continued use after changes constitutes acceptance.

13. Contact Us

For privacy-related questions or to exercise your rights:

Email: hello@echopitch.io
Data Controller: Cavefish
ICO Registration: ZB915633

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.